Executing Applications, Hiding Files, Persistence and Clearing Logs

What it is

After gaining and raising access, an attacker runs programs on the system, hides them, makes sure they survive a restart, and then removes the evidence. These are the later steps of system hacking.

For the exam, learn the name and purpose of each technique, how a defender notices it and which control stops it.

How it works

Executing applications

Executing applications means running code on the compromised host, usually from a remote location. The code may be a backdoor, a keylogger, a spyware agent or a remote administration tool.

Attackers prefer methods that look normal.

Because legitimate tools are used, detection depends on behavior: unusual parent and child processes, remote execution from a user workstation and scripts started from odd locations.

Hiding files

Rootkits are classified by where they run: user mode, kernel mode, library level, bootkit (infects the boot sector), firmware and hypervisor. A kernel rootkit is harder to find because it controls what the operating system reports. Detection uses tools that compare views, scan from outside the running system, or use integrity checks. Tools include GMER and tools that scan from a clean boot medium. The only safe remedy for a serious rootkit is often a rebuild from trusted media.

Alternate data streams are an NTFS feature. A file can have a second stream that does not show in a normal directory listing. Defenders can list streams with a directory option and with Sysinternals streams tool.

Steganography differs from cryptography. Cryptography hides the meaning of a message, while steganography hides its existence. Types include image, audio, video, document and network steganography. Tools include OpenStego, Steghide, QuickStego and SNOW. Steganalysis is the practice of detecting hidden data, for example by comparing file statistics.

Establishing persistence

Persistence makes access survive a reboot or logoff.

Detection compares the system against a baseline and looks at autorun locations, tasks, services and accounts. Sysinternals Autoruns lists many Windows startup locations.

Clearing logs

Clearing logs aims to remove or alter evidence.

Clearing the Windows Security log itself creates an event, with event ID 1102, and clearing the System log creates event ID 104. These events are valuable to defenders. Linux logs are mostly under /var/log, and shell history is stored per user.

Defenses work by moving evidence out of the attacker's reach.

• Send logs to a central, protected server so that local deletion does not erase them.
• Restrict who can clear logs or change audit policy and alert when it happens.
• Use file integrity monitoring.
• Keep enough log capacity and retention for investigations.
• Use time synchronization so that timeline analysis is reliable.

Countermeasures for the whole group

• Use application allow lists to control what executes.
• Monitor processes, command lines and remote execution.
• Scan for rootkits, hidden streams and unexpected autorun entries.
• Rebuild from trusted images after a serious compromise.
• Apply least privilege so attackers cannot write to startup locations.

A worked example

An analyst finds an alert that the Security log was cleared on a server at 03:10. Event ID 1102 shows which account did it. Logs forwarded to the SIEM still hold the previous activity, and they show a scheduled task and a new service created minutes earlier by the same account.

How the exam asks about this

• "Which technique hides data inside an image file?" -> Steganography.
• "Which NTFS feature hides data in a second stream of a file?" -> Alternate data streams.
• "Which event ID shows that the Windows Security log was cleared?" -> 1102.